Following the temporary shutdown of Claude Fable 5 and Claude Mythos 5, it is important to distinguish between understanding attack concepts and understanding how to execute them.
Most of the techniques discussed in public reports are not “hacking” in the traditional sense of breaking into a computer system. Instead, they are attempts to cause a Large Language Model (LLM) to interpret a request differently than its safety mechanisms intended.
Understanding these concepts helps security professionals design better defenses, identify architectural weaknesses, and improve AI safety without focusing on operational exploitation.
1. Token Manipulation
The Concept
A language model does not read words the way humans do.
Instead, it breaks text into smaller units called tokens.
For example:
security
may be represented internally as one or more tokens.
The challenge arises because an external safety filter may process text differently than the primary model.
If:
- The filter is looking for specific words or patterns
- The model understands broader context and meaning
a gap may emerge between what the filter sees and what the model understands.
Conceptual Example
A human can easily recognize:
m a l w a r eormal-ware
as the same word.
A simple pattern-matching filter may fail to recognize the modified form, while the model still understands the intended meaning through context.
Key Principle
The objective is to create a situation where:
- The filter sees one thing
- The model interprets another
2. Homoglyphs
The Concept
Characters from different alphabets can appear visually identical.
For example:
A (Latin)
А (Cyrillic)
To humans they look nearly identical.
To a computer they are completely different characters.
Why It Matters
Systems that rely on exact text matching may become confused.
A user may see:
APPLE
while some of the characters actually belong to a different alphabet.
Security Relevance
This technique is well known in:
- Domain impersonation
- Phishing attacks
- Username spoofing
3. Encoding Tricks
(Base64 and Similar Encodings)
The Concept
Instead of sending plain text, information is represented in another format.
For example:
Hello
can be encoded into an alternative representation.
Many language models are capable of recognizing or translating encoded content.
Why It Matters
A security system inspecting the original input may only see an apparently meaningless string.
The model itself may be capable of interpreting or decoding that content as part of the conversation.
Key Principle
Hide meaning within an alternative representation.
4. AI vs. AI
The Concept
Instead of a human manually testing thousands of prompt variations, another AI model can generate and evaluate them automatically.
Think of it this way:
One researcher
=
100 attempts
versus
An AI model
=
100,000 attempts
What Is Being Measured?
Researchers look for:
- What gets blocked
- What gets accepted
- Which wording changes the outcome
Security Analogy
This approach is very similar to fuzzing in traditional security testing.
5. Context Stuffing
The Concept
LLMs operate within a context window.
They attempt to process and understand all information available in that window.
When extremely large amounts of information are provided:
- Stories
- Documents
- Characters
- Instructions
the model must distribute attention across all of it.
Why It Matters
Some instructions may receive less attention compared to newer information appearing later in the context.
Analogy
Imagine reading a 500-page book and then being asked about a small note on page one.
The information may still exist, but it becomes harder to prioritize.
6. Role-Play Exploitation
The Concept
Language models are designed to simulate roles and perspectives.
Examples include:
- Teacher
- Lawyer
- Historian
- Fictional character
As the model adopts a role, it attempts to remain consistent with that role.
The Challenge
Sometimes tension emerges between:
- The assigned role
- Safety policies
The system must determine which instruction takes precedence.
7. Task Decomposition
The Concept
Instead of requesting a large objective directly, a complex problem is divided into many smaller tasks.
For example:
Large Problem
↓
Step 1
Step 2
Step 3
Step 4
Each individual task may appear harmless or legitimate.
Why It Matters
Many safety systems evaluate requests independently.
Understanding intent becomes more difficult when only a small portion of the overall objective is visible.
Security Analogy
This resembles the concept of:
Living Off The Land
Multiple legitimate actions may combine into a larger operational outcome.
8. System Prompt Extraction
The Concept
Every language model receives internal instructions before a conversation begins.
These instructions may contain guidance such as:
You are an AI assistant.
Do not reveal private information.
Do not provide harmful content.
...
Users normally do not see these instructions.
Why Researchers Study Them
They can reveal:
- How the model is configured
- What rules it follows
- What limitations exist
- Which safety mechanisms are in place
Security Analogy
This is similar to studying a system’s architecture before evaluating its weaknesses.
The Security Engineer’s Perspective
The most interesting aspect is not any individual technique.
The real lesson is that nearly all modern LLM jailbreak research attempts to exploit a classic security principle:
A gap between layers.
This concept is already familiar to anyone with experience in Web Application Firewalls (WAFs).
A WAF may interpret a request one way, while the application interprets it differently.
Similarly, an LLM environment often contains multiple layers:
User Input
↓
Classifier
↓
Safety Layer
↓
LLM
Many jailbreak techniques attempt to identify situations where two layers interpret the same information differently.
From a security engineering perspective, this closely resembles familiar concepts such as:
- Canonicalization issues
- Evasion techniques
- Parser differentials
The technology is new, but the underlying security principles are surprisingly familiar.